fix(ci): enforce C0/NUL corruption in-step; warn on invisible Unicode

Second layer of the empty-linter fix, scoped by an owner ruling after a census.

DETECTION (layer 1, earlier commit on this branch) sees everything the
pattern covers. ENFORCEMENT (this commit) distinguishes two classes:

  BLOCKING  C0 control characters and NUL. Never legitimate; proven damage -
            a backspace byte made a workflow unloadable (it never ran once),
            and LaTeX maths in wiki files was silently mangled where a
            generation step turned backslash-b commands into backspaces.
  ADVISORY  NBSP, BOM, zero-width marks. A gate-lens census found ~2,100
            first-party files carry these as legitimate typography in prose;
            blocking would fail 2,333 files estate-wide for no safety gain.

Enforcement lives INSIDE the scan step: if the scanner crashes, the step
fails the job directly, so empty counts can never drift into a separate
check that passes silently (review finding). The blocking count re-greps
only the files the full pattern already flagged, so the find expression is
not duplicated and cannot drift.

1 file(s). YAML re-parsed per edit; reverted on any mis-apply.

Author: hyperpolymath

.github/workflows/dogfood-gate.yml

@@ -147,13 +147,41 @@ jobs:
           echo "exit_code=$EL_EXIT" >> "$GITHUB_OUTPUT"
           echo "ready=true" >> "$GITHUB_OUTPUT"
 
+          # Blocking subset: C0 controls and NUL only (owner ruling 2026-08-28).
+          # Invisible Unicode (NBSP/BOM/zero-width) stays ADVISORY - about 2,100
+          # estate files carry it as legitimate typography in prose.
+          blocking=0
+          while IFS= read -r bf; do
+            [ -z "$bf" ] && continue
+            if grep -qaP '\x00|[\x01-\x08\x0B\x0C\x0E-\x1F]' "$bf"; then
+              blocking=$((blocking+1))
+              echo "::error file=${bf#$GITHUB_WORKSPACE/}::C0 control characters or NUL bytes - file corruption, blocks the gate"
+            fi
+          done < /tmp/empty-lint-results.txt
+          echo "blocking=$blocking" >> "$GITHUB_OUTPUT"
+
           # Emit annotations for each file with invisible chars
           while IFS= read -r filepath; do
             [ -z "$filepath" ] && continue
             REL_PATH="${filepath#$GITHUB_WORKSPACE/}"
             echo "::warning file=${REL_PATH}::Invisible Unicode characters detected (zero-width space, BOM, NBSP, etc.)"
           done < /tmp/empty-lint-results.txt
 
+          # Enforce (owner ruling 2026-08-28): C0/NUL corruption BLOCKS; other
+          # invisible Unicode stays advisory. Enforcement lives inside this step
+          # so a crash above fails the job directly - counts can never arrive
+          # empty into a separate check that then passes silently.
+          if [ "$EL_EXIT" -ne 0 ]; then
+            echo "::warning::invisible-character scan exited $EL_EXIT - results may be incomplete"
+          fi
+          if [ "${blocking:-0}" -gt 0 ]; then
+            echo "## Empty-linter: BLOCKED - $blocking file(s) with C0/NUL corruption" >> "$GITHUB_STEP_SUMMARY"
+            echo "::error::$blocking file(s) contain C0 control characters or NUL bytes - corruption, not typography. See file annotations."
+            exit 1
+          elif [ "${FINDINGS:-0}" -gt 0 ]; then
+            echo "::notice::$FINDINGS file(s) carry invisible Unicode (NBSP/BOM/zero-width) - advisory only"
+          fi
+
       - name: Write summary
         run: |
           if [ "${{ steps.lint.outputs.ready }}" = "true" ]; then